userdomain: no longer allow unprivileged users to read kernel symbols
PATCH 1/1 userdomain: no longer allow unprivileged users to read kernel symbols
Unprivileged users don't need to read kallsyms and /boot/System.map.
This allow rule was introduced in the initial revision of userdomain.if in 2005, with commit b16c6b8c32a631a2e66265f6f60b664222760972:
# cjp: why?
bootloader_read_kernel_symbol_table($1_t)
---
policy/modules/system/userdomain.if | 2 --
1 file changed, 2 deletions(-)policy/modules/system/userdomain.if +0 -2
@@ -1005,8 +1005,6 @@ template(`userdom_unpriv_user_template', ` corenet_tcp_bind_xserver_port($1_t) files_exec_usr_files($1_t) - # cjp: why? - files_read_kernel_symbol_table($1_t) ifndef(`enable_mls',` fs_exec_noxattr($1_t)
Signature · 1 line
1.9.0
PATCH 1/1 userdomain: no longer allow unprivileged users to read kernel symbols
Quoted 16 lines · Nicolas Iooss
Unprivileged users don't need to read kallsyms and
/boot/System.map.This allow rule was introduced in the initial revision of userdomain.if in 2005, with commit
b16c6b8c32a631a2e66265f6f60b664222760972:# cjp: why? bootloader_read_kernel_symbol_table($1_t) --- policy/modules/system/userdomain.if | 2 -- 1 file changed, 2 deletions(-)policy/modules/system/userdomain.if +0
-0
policy/modules/system/userdomain.if template(`userdom_unpriv_user_template', ` · line 1010
Quoted 8 lines
policy/modules/system/userdomain.if +0
-2@@ -1005,8 +1005,6 @@ template(`userdom_unpriv_user_template', ` corenet_tcp_bind_xserver_port($1_t) files_exec_usr_files($1_t) - # cjp: why? - files_read_kernel_symbol_table($1_t) ifndef(`enable_mls',` fs_exec_noxattr($1_t)
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com